sentinelops-real-time-siem-soc

KO | EN

gitlite — search

#python #java #python3 #arduino #golang #machine-learning #rust #html #flask #javascript #seismology #nodejs

sentinelops-real-time-siem-soc

★ 20 Open GitHub ↗

Real-time SIEM & SOC monitoring platform built using Wazuh, Python Flask, Kali Linux, and Telegram alerting for threat detection and incident monitoring.

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# SentinelOPS – Real-Time SIEM & SOC Monitoring Platform

![Cybersecurity](https://img.shields.io/badge/Cybersecurity-SIEM-blue)
![Wazuh](https://img.shields.io/badge/Wazuh-4.7-green)
![Python](https://img.shields.io/badge/Python-3.11-yellow)
![Flask](https://img.shields.io/badge/Flask-API-red)
![Status](https://img.shields.io/badge/Status-Active-success)

---

# Overview

SentinelOPS is a Security Information and Event Management (SIEM) and Security Operations Center (SOC) monitoring platform designed to demonstrate real-world threat detection, log analysis, security monitoring, and incident response workflows within a controlled cybersecurity laboratory environment.

The platform integrates Wazuh, Python Flask, Linux-based infrastructure, and automated Telegram alerting to create an end-to-end security monitoring pipeline. Security events generated by monitored systems are collected, analyzed, correlated, and transformed into actionable alerts that can be viewed through a dashboard and delivered directly to analysts through mobile notifications.

Unlike many academic cybersecurity projects that rely on synthetic datasets or simulated alerts, SentinelOPS utilizes actual attack traffic generated within a virtualized lab environment. This approach enables practical observation of attack detection, event processing, and incident monitoring techniques commonly used in enterprise Security Operations Centers.

The primary objective of the project is to develop hands-on experience with SIEM architecture, security analytics, log management, threat detection, alert engineering, and SOC operations.

---

# Project Objectives

The development of SentinelOPS focuses on the following objectives:

* Understanding Security Information and Event Management (SIEM) architecture.
* Implementing centralized log collection and analysis.
* Detecting malicious activities using security monitoring tools.
* Building automated alerting and notification workflows.
* Mapping security events to the MITRE ATT&CK framework.
* Developing practical experience with SOC operations.
* Studying incident detection and response methodologies.
* Creating a scalable foundation for future security automation capabilities.

---

# System Architecture

The SentinelOPS architecture consists of four primary layers: attack simulation, monitored infrastructure, security analytics, and alert delivery.

The attack simulation layer generates security events using offensive security tools such as Hydra and Nmap. These attacks are executed from a Kali Linux virtual machine operating within an isolated laboratory environment.

The monitored infrastructure layer consists of an Ubuntu Server configured as the target system. Authentication logs, security events, and operating system telemetry generated by the server are continuously monitored by a Wazuh agent.

The security analytics layer is powered by Wazuh, which performs log collection, normalization, rule evaluation, event correlation, and threat detection. Security events identified by Wazuh are stored and processed for further analysis.

The alert delivery layer includes custom Python Flask services and Telegram integration. This layer processes security alerts, exposes data through APIs, and delivers real-time notifications to analysts while simultaneously providing data for dashboard visualization.

```text
Attacker (Kali Linux)
        │
        ▼
SSH Brute Force / Nmap Scan
        │
        ▼
Ubuntu Server
        │
        ▼
Wazuh SIEM
(Log Collection & Analysis)
        │
        ▼
alerts.json
        │
 ┌──────┴──────┐
 ▼             ▼

Flask API      Telegram Alerter
 ▼             ▼

Dashboard      Mobile Alerts
```

[INSERT ARCHITECTURE DIAGRAM IMAGE HERE]

---

# Technology Stack

## Security Monitoring

* Wazuh SIEM
* MITRE ATT&CK Framework
* Security Event Correlation
* Threat Detection Rules

## Attack Simulation

* Hydra
* Nmap

## Backend Development

* Python 3
* Flask
* Flask-CORS
* Requests

## Infrastructure

* Kali Linux
* Ubuntu Server
* VirtualBox

## Notification Services

* Telegram Bot API

---

# Detection Engineering

SentinelOPS implements multiple detection mechanisms designed to identify suspicious and malicious activities within the monitored environment.

## SSH Brute Force Detection

The platform monitors repeated authentication failures occurring within a short period of time. When predefined thresholds are exceeded, Wazuh generates security alerts indicating potential password guessing activity.

## Network Reconnaissance Detection

Port scanning activities performed using Nmap generate observable network behavior that can be correlated with security events. These events provide visibility into reconnaissance activities commonly observed during the early stages of cyber attacks.

## Authentication Monitoring

The platform continuously monitors successful and failed authentication events. Suspicious authentication patterns can be identified and analyzed through centralized log management.

## Security Alert Processing

Detected events are automatically processed by custom Python services and transformed into structured alerts suitable for dashboard visualization and mobile notifications.

---

# Security Monitoring Workflow

The monitoring workflow implemented by SentinelOPS follows the same general principles used within enterprise Security Operations Centers.

1. An attack is launched from the Kali Linux attacker machine.
2. The target Ubuntu server generates security-related log entries.
3. Wazuh collects and analyzes security telemetry.
4. Detection rules evaluate incoming events.
5. Suspicious activities trigger security alerts.
6. Alert data is processed through Flask-based services.
7. Notifications are delivered through Telegram.
8. Security events are displayed within the monitoring dashboard.

```text
Hydra Attack
     │
     ▼
Failed SSH Logins
     │
     ▼
Wazuh Rule Triggered
     │
     ▼
Security Alert Generated
     │
     ▼
Telegram Notification
```

[INSERT DETECTION WORKFLOW IMAGE HERE]

---

# MITRE ATT&CK Mapping

The platform aligns detected activities with the MITRE ATT&CK framework to provide additional context regarding attacker behavior.

| Technique ID | Technique                 |
| ------------ | ------------------------- |
| T1110.001    | Password Guessing         |
| T1046        | Network Service Discovery |
| T1078        | Valid Accounts            |
| T1548.003    | Sudo and Sudo Caching     |

This mapping assists in understanding the tactics and techniques associated with detected activities and helps simulate real-world SOC analysis workflows.

---

# Screenshots

## Wazuh Security Events

## Real-Time Alert Dashboard

## Telegram Security Notifications

---

# Installation Guide

## Clone Repository

```bash
git clone https://github.com/YOUR_USERNAME/sentinelops-real-time-siem-soc.git
cd sentinelops-real-time-siem-soc
```

## Install Dependencies

```bash
pip install flask flask-cors requests
```

## Start Backend API

```bash
python3 backend/api.py
```

## Start Telegram Alert Service

```bash
python3 backend/alerter.py
```

---

# Attack Simulation

## SSH Brute Force Attack

```bash
hydra -l username -P /usr/share/wordlists/rockyou.txt ssh://TARGET_IP
```

## Network Reconnaissance Scan

```bash
nmap -sS -p 1-1024 TARGET_IP
```

All attack simulations are performed exclusively within a controlled laboratory environment owned and operated by the author.

---

# Knowledge and Skills Acquired

The development of SentinelOPS provided practical exposure to multiple cybersecurity domains, including:

* SIEM Engineering
* Security Monitoring
* Log Collection and Analysis
* Threat Detection
* Incident Response
* Linux Administration
* Security Automation
* Alert Engineering
* Detection Engineering
* SOC Operations
* MITRE ATT&CK Mapping

The project also strengthened understanding of enterprise security workflows and the challenges associated with collecting, processing, correlating, and responding to security telemetry.

---

# Future Development Roadmap

Several enhancements are planned for future versions of SentinelOPS:

* AI-Based Anomaly Detection
* Automated IP Blocking
* Email Alert Integration
* Threat Intelligence Feeds
* Advanced Event Correlation Engine
* Cloud-Based Deployment
* Interactive SOC Dashboard
* Multi-User Access Control
* Security Case Management
* Automated Incident Response

---

# Demonstration Video

YouTube Demonstration:

https://youtu.be/4ggKs061MCs

---

# Project Information

Project Name: SentinelOPS

Project Type: Real-Time SIEM & SOC Monitoring Platform

Developer: Shiva Sai Raj Chinthakuntla

Associated Platform: CipherNest

Development Status: Active

Repository Creation Year: 2026

---

# Author

Shiva Sai Raj Chinthakuntla

Cybersecurity Student | Linux Enthusiast | SOC & Security Engineering Learner

Focused on building practical cybersecurity projects, documenting the learning process, and exploring real-world security monitoring technologies.

---

# Disclaimer

This project was developed strictly for educational, research, and cybersecurity learning purposes.

All attack simulations, monitoring activities, and security experiments were conducted within isolated laboratory environments owned and controlled by the author. No unauthorized systems, networks, or third-party infrastructure were targeted during the development or testing of this project.

sentinelops-real-time-siem-soc

Explore Similar Repositories

Was this content helpful?

Recent Feedback

Download README